added Malcolm
This commit is contained in:
308
Vagrant/resources/malcolm/nginx/nginx.conf
Normal file
308
Vagrant/resources/malcolm/nginx/nginx.conf
Normal file
@@ -0,0 +1,308 @@
|
||||
# Copyright (c) 2021 Battelle Energy Alliance, LLC. All rights reserved.
|
||||
|
||||
daemon off;
|
||||
|
||||
worker_processes 1;
|
||||
|
||||
events { worker_connections 1024; }
|
||||
|
||||
http {
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
sendfile on;
|
||||
|
||||
client_max_body_size 20m;
|
||||
|
||||
fastcgi_buffers 16 64k;
|
||||
fastcgi_buffer_size 256k;
|
||||
fastcgi_read_timeout 300s;
|
||||
fastcgi_busy_buffers_size 384k;
|
||||
fastcgi_request_buffering off;
|
||||
|
||||
proxy_connect_timeout 180s;
|
||||
proxy_read_timeout 300s;
|
||||
proxy_send_timeout 300s;
|
||||
proxy_buffer_size 512k;
|
||||
proxy_buffers 16 4m;
|
||||
proxy_busy_buffers_size 16m;
|
||||
|
||||
# if LDAP authentication is enabled, this will configure the ldap_server section
|
||||
include /etc/nginx/nginx_ldap_rt.conf;
|
||||
|
||||
upstream docker-arkime {
|
||||
server arkime:8005;
|
||||
}
|
||||
|
||||
upstream docker-malcolm-readme {
|
||||
server arkime:8000;
|
||||
}
|
||||
|
||||
upstream docker-upload {
|
||||
server upload:80;
|
||||
}
|
||||
|
||||
upstream docker-htadmin {
|
||||
server htadmin:80;
|
||||
}
|
||||
|
||||
upstream docker-kibana {
|
||||
server kibana:5601;
|
||||
}
|
||||
|
||||
upstream docker-kibana-maps {
|
||||
server kibana-helper:28991;
|
||||
}
|
||||
|
||||
upstream docker-elasticsearch {
|
||||
server elasticsearch:9200;
|
||||
}
|
||||
|
||||
upstream docker-logstash-stats {
|
||||
server logstash:9600;
|
||||
}
|
||||
|
||||
upstream docker-name-map-ui {
|
||||
server name-map-ui:8080;
|
||||
}
|
||||
|
||||
upstream docker-extracted-file-http-server {
|
||||
server file-monitor:8440;
|
||||
}
|
||||
|
||||
# htadmin (htpasswd/user management)
|
||||
server {
|
||||
listen 488 ssl;
|
||||
ssl_certificate /etc/nginx/certs/cert.pem;
|
||||
ssl_certificate_key /etc/nginx/certs/key.pem;
|
||||
|
||||
location / {
|
||||
proxy_pass http://docker-htadmin;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host htadmin.malcolm.local;
|
||||
}
|
||||
}
|
||||
|
||||
# Arkime interface
|
||||
server {
|
||||
listen 443 ssl;
|
||||
ssl_certificate /etc/nginx/certs/cert.pem;
|
||||
ssl_certificate_key /etc/nginx/certs/key.pem;
|
||||
|
||||
# use either auth_basic or auth_ldap
|
||||
include /etc/nginx/nginx_auth_rt.conf;
|
||||
|
||||
# Malcolm readme
|
||||
location /readme {
|
||||
proxy_pass http://docker-malcolm-readme/README.html;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host arkime.malcolm.local;
|
||||
}
|
||||
|
||||
# Malcolm file upload
|
||||
location /upload {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_pass http://docker-upload/;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host upload.malcolm.local;
|
||||
proxy_request_buffering off;
|
||||
proxy_buffering off;
|
||||
client_max_body_size 20G;
|
||||
}
|
||||
location /server/php {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_pass http://docker-upload/server/php/;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host upload.malcolm.local;
|
||||
proxy_request_buffering off;
|
||||
proxy_buffering off;
|
||||
client_max_body_size 20G;
|
||||
}
|
||||
|
||||
# Logstash statistics
|
||||
location ~* ^/logstash\b(.*) {
|
||||
proxy_pass http://docker-logstash-stats/_node/stats$1;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host arkime.malcolm.local;
|
||||
}
|
||||
|
||||
# Arkime -> Kibana shortcut
|
||||
location ~* ^/idmol2kib(.*) {
|
||||
|
||||
set $filter_start_time now-1d;
|
||||
if ($arg_start != '') {
|
||||
set $filter_start_time \'$arg_start\';
|
||||
}
|
||||
|
||||
set $filter_stop_time now;
|
||||
if ($arg_stop != '') {
|
||||
set $filter_stop_time \'$arg_stop\';
|
||||
}
|
||||
|
||||
set $filter_field undefined;
|
||||
if ($arg_field != '') {
|
||||
set $filter_field $arg_field;
|
||||
}
|
||||
|
||||
set $filter_value undefined;
|
||||
if ($arg_value != '') {
|
||||
set $filter_value $arg_value;
|
||||
}
|
||||
|
||||
rewrite ^/idmol2kib/(.*) /kibana/app/discover#/?_g=(refreshInterval:(pause:!t,value:0),time:(from:$filter_start_time,mode:absolute,to:$filter_stop_time))&_a=(columns:!(_source),filters:!((meta:(alias:!n,disabled:!f,index:'sessions2-*',key:$filter_field,negate:!f,params:(query:'$filter_value',type:phrase),type:phrase,value:'$filter_value'),query:(match:($filter_field:(query:'$filter_value',type:phrase))))),index:'sessions2-*',interval:auto,query:(language:lucene,query:''),sort:!(firstPacket,desc)) redirect;
|
||||
proxy_pass http://docker-kibana;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host kibana.malcolm.local;
|
||||
}
|
||||
|
||||
# Kibana -> Arkime shortcut
|
||||
location ~* /idkib2mol/(.*) {
|
||||
rewrite ^.*/idkib2mol/(.*) /sessions?expression=($1) redirect;
|
||||
proxy_pass http://docker-arkime;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host arkime.malcolm.local;
|
||||
proxy_set_header http_auth_http_user $remote_user;
|
||||
proxy_set_header Authorization "";
|
||||
}
|
||||
|
||||
# Kibana/Arkime -> extracted file download
|
||||
location ~* /dl-extracted-files/(.*) {
|
||||
rewrite ^.*/dl-extracted-files/(.*) /extracted-files/$1 redirect;
|
||||
proxy_pass http://docker-extracted-file-http-server;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host file-monitor.malcolm.local;
|
||||
}
|
||||
|
||||
# already prepended /kibana to match the server.basePath in kibana's YML config file
|
||||
location /kibana {
|
||||
proxy_pass http://docker-kibana;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host kibana.malcolm.local;
|
||||
}
|
||||
|
||||
# otherwise (from old kibana bookmarks), prepend /kibana to match the server.basePath in kibana's YML config file
|
||||
location /app {
|
||||
proxy_pass http://docker-kibana/kibana/app;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host kibana.malcolm.local;
|
||||
}
|
||||
|
||||
# offline region maps for kibana
|
||||
location /world.geojson {
|
||||
proxy_pass http://docker-kibana-maps;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host kibana-helper.malcolm.local;
|
||||
}
|
||||
|
||||
# name-map-ui (UI for mapping names to network hosts and subnets)
|
||||
location /name-map-ui {
|
||||
proxy_pass http://docker-name-map-ui/;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host name-map-ui.malcolm.local;
|
||||
proxy_cache off;
|
||||
}
|
||||
|
||||
location ~* ^/extracted-files\b(.*) {
|
||||
proxy_pass http://docker-extracted-file-http-server$1;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host file-monitor.malcolm.local;
|
||||
}
|
||||
|
||||
location = /favicon.ico {
|
||||
alias /etc/nginx/favicon.ico;
|
||||
}
|
||||
|
||||
# Fix cyberchef JS module(s)
|
||||
# https://localhost/moloch/session/190924-KgO9H30qhdREw7ltsDXn1Rgp/modules/Regex.js
|
||||
location ~* ^/moloch/session/.*/(modules/.*\.js) {
|
||||
proxy_hide_header Content-Type;
|
||||
proxy_set_header Content-Type "application/javascript";
|
||||
add_header Content-Type "application/javascript";
|
||||
default_type application/javascript;
|
||||
add_header X-Content-Type-Options 'nosniff';
|
||||
proxy_pass http://docker-arkime/cyberchef/$1;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host arkime.malcolm.local;
|
||||
proxy_set_header http_auth_http_user $remote_user;
|
||||
proxy_set_header Authorization "";
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://docker-arkime;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host arkime.malcolm.local;
|
||||
proxy_set_header http_auth_http_user $remote_user;
|
||||
proxy_set_header Authorization "";
|
||||
}
|
||||
}
|
||||
|
||||
# Kibana interface
|
||||
server {
|
||||
listen 5601 ssl;
|
||||
ssl_certificate /etc/nginx/certs/cert.pem;
|
||||
ssl_certificate_key /etc/nginx/certs/key.pem;
|
||||
|
||||
# use either auth_basic or auth_ldap
|
||||
include /etc/nginx/nginx_auth_rt.conf;
|
||||
|
||||
location = /favicon.ico {
|
||||
alias /etc/nginx/favicon.ico;
|
||||
}
|
||||
|
||||
# Kibana -> Arkime shortcut
|
||||
location ~* /idkib2mol/(.*) {
|
||||
rewrite ^.*/idkib2mol/(.*) /sessions?expression=($1) redirect;
|
||||
proxy_pass http://docker-arkime;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host arkime.malcolm.local;
|
||||
proxy_set_header http_auth_http_user $remote_user;
|
||||
proxy_set_header Authorization "";
|
||||
}
|
||||
|
||||
# Kibana -> extracted file download
|
||||
location ~* /dl-extracted-files/(.*) {
|
||||
rewrite ^.*/dl-extracted-files/(.*) /extracted-files/$1 redirect;
|
||||
proxy_pass http://docker-extracted-file-http-server;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host file-monitor.malcolm.local;
|
||||
}
|
||||
|
||||
# already prepended /kibana to match the server.basePath in kibana's YML config file
|
||||
location /kibana {
|
||||
proxy_pass http://docker-kibana;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host kibana.malcolm.local;
|
||||
}
|
||||
|
||||
# otherwise prepend /kibana to match the server.basePath in kibana's YML config file
|
||||
location / {
|
||||
rewrite ^/(.*) /kibana/$1;
|
||||
proxy_pass http://docker-kibana;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host kibana.malcolm.local;
|
||||
}
|
||||
}
|
||||
|
||||
# Elasticsearch API
|
||||
server {
|
||||
listen 9200 ssl;
|
||||
ssl_certificate /etc/nginx/certs/cert.pem;
|
||||
ssl_certificate_key /etc/nginx/certs/key.pem;
|
||||
|
||||
# use either auth_basic or auth_ldap
|
||||
include /etc/nginx/nginx_auth_rt.conf;
|
||||
|
||||
location = /favicon.ico {
|
||||
alias /etc/nginx/favicon.ico;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://docker-elasticsearch;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host es.malcolm.local;
|
||||
client_max_body_size 50m;
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user